CVE-2021-35503

MediumCVSS 6.1/10Last modified Jul 5, 2026

Description

Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 5, 2021
Last modified
Jul 5, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-355047.2Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.CVE-2021-355057.2Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.CVE-2021-355066.1Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit CVE-2021-355088.8NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged uCVE-2021-35517.8A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log fiCVE-2021-355126.5An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.CVE-2021-355136.1Mermaid before 8.11.0 allows XSS when the antiscript feature is used.CVE-2021-355149.8Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.CVE-2021-355157.5When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop.CVE-2021-355167.5When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memoryCVE-2021-355177.5When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memorCVE-2021-35527.5A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attack
CVE-2021-35503: Medium severity, CVSS 6.1 | Vulnix